Run pxm dashboard as the Linux account that owns your PXM workspace. Open the private link printed in the terminal within ten minutes. Keep the command running while using the dashboard.
The dashboard listens only on 127.0.0.1:7431. For a remote server, use the SSH command it prints, forwarding the same port to your computer. Choose --port 17431 if the default port is already occupied. There is no public bind option.
The interface includes sites, managed services, installed and available PHP/Node versions, local database snapshots, configured offsite backup plans, Cloudflare sharing, Mailpit inboxes and private application diagnostics. Mutating operations use the same validated CLI commands as the terminal. Jobs report completion without blocking navigation. Stop, restart, backup, update and restore actions require confirmation; restore also requires the exact service name. Service creation, imports and backup destination credentials remain in the CLI.
Application health checks use a site's explicitly configured endpoint. An HTTP health failure does not automatically restart a worker. Existing websites remain available when a replacement fails its configured deployment check.
The private bootstrap link is single use. Browser sessions expire after thirty minutes without requests or eight hours total. Signing out removes the session. Restart the dashboard for a new link after signing out or expiry. Automatic foreground status polling keeps an open active tab connected.
The fragment token is removed from the address bar before sign-in. API authentication uses an origin-scoped session bearer and an independent CSRF token, not cookies shared across local ports. Foreign hosts, origins and non-loopback peers are refused. The service does not accept arbitrary shell commands, credentials, runtime URLs or filesystem paths through its API. Never publish the dashboard through a reverse proxy or share its private link.
Closing the dashboard leaves your managed databases and sites running. If a management operation was interrupted, check its current status before retrying.
Mail and diagnostics
The Mail page reads a selected, registered Mailpit service. Preview, Text, HTML and Raw share a fixed toolbar and reading area. Preview uses an opaque iframe sandbox with no permissions, an explicit content policy and a small HTML allowlist. Scripts, external images, tracking pixels, links, forms, frames and remote styles cannot run or load. HTML and Raw are displayed as text. Attachments and messages exceeding the bounded API limit can be inspected through Mailpit's own local interface. Deleting a message requires confirmation.
Diagnostics can enable or disable the private collector, attach capture to a PHP site, inspect bounded event summaries and view complete event JSON as text. Attaching capture deploys the selected PHP worker. Clearing recorded diagnostics requires confirmation; disabling capture keeps existing events. Capture requires PXM Pro and can contain application information, so use it only where recording is intended.
Signing out closes open detail dialogs and clears mail and diagnostic content from the dashboard. No diagnostic payload or mailbox credential is written to browser storage.